[lockfile-stats] Lockfile Statistics Analysis — 2026-09-25

[github-actions[bot]]

Lockfile Statistics — 2026-09-25

Analysis of all .github/workflows/*.lock.yml compiled workflow files in github/gh-aw. Methodology: single-script compact JSON analysis (lockfile_stats_v4.py, cached in cache-memory/scripts/).

Executive summary

Metric	Value
Lockfiles analyzed	298 (0 skipped/malformed)
Total size	46,800,520 bytes (~44.6 MB)
Avg / min / max size	157,049 / 92,098 / 250,672 bytes
workflow_dispatch enabled	290 (97.3%)
create_discussion configured	92 (30.9%)
Engines detected	13 distinct, 0 unknown

File size distribution

Sizes cluster tightly around the mean (~153 KB), with a ~2.7x spread between smallest and largest lockfile — largest files correlate with high job/step counts (see Structural characteristics).

Trigger analysis

Trigger	Count	% of 298
workflow_dispatch	290	97.3%
schedule	242	81.2%
pull_request	43	14.4%
issues	5	1.7%
issue_comment	3	1.0%
workflow_call	3	1.0%
discussion / discussion_comment / push / workflow_run / deployment_status / pull_request_review_comment	1 each	0.3%

Top trigger combinations: schedule+workflow_dispatch (209, 70.1%), workflow_dispatch alone (37), pull_request+schedule+workflow_dispatch (29), pull_request+workflow_dispatch (9).

Cron concentration: 42 workflows (17.4% of the 242 scheduled) share the exact same cron 0 0 */2 * * (every 2 days at midnight UTC) — the single largest cluster by far. The remaining ~200 scheduled workflows are scattered across unique minute/hour offsets (mostly count 1-3), suggesting deliberate staggering elsewhere but a stampede risk at that one slot.

Safe outputs analysis

Built-in safe-output primitives (missing_data, missing_tool, noop, report_incomplete, create_report_incomplete_issue) appear in 292/298 (98.0%) of workflows — effectively universal infrastructure.

Output type	Count	%
create_issue	145	48.7%
create_discussion	92	30.9%
add_comment	76	25.5%
create_pull_request	64	21.5%
push_repo_memory	36	12.1%
add_labels	32	10.7%
upload_asset	26	8.7%
mentions	23	7.7%
create_pull_request_review_comment / submit_pull_request_review	16 each	5.4%

Full safe-output type tail (54 types total)

upload_artifact 14, create_check_run 14, push_to_pull_request_branch 11, update_issue 10, max_bot_mentions 8, close_issue 7, remove_labels 7, comment_memory 6, dispatch_workflow 6, update_pull_request 5, assign_to_agent 5, link_sub_issue 4, close_pull_request 4, send-slack-message 4, create_code_scanning_alert 3, close_discussion 3, reply_to_pull_request_review_comment 3, set_issue_type 3, and 20+ types at count 1-2 (jira_*, linear_create_issue, update_project, etc.)

Discussion categories (92 create_discussion workflows, 100% category-resolved, 0 unresolved):

Category	Count	% of 92
audits	79	85.9%
announcements	5	5.4%
artifacts	2	2.2%
dev	2	2.2%
research	2	2.2%
general	1	1.1%
daily-news	1	1.1%

Self-check passed: create_discussion_workflows (92) == discussion_category_detected (92); safe_outputs_config_missing = 0.

Structural characteristics

Metric	Avg	Max
Jobs / workflow	7.35	14
Steps / workflow	146.0	210
Script-like steps / workflow	100.95	141

Permission patterns

Derived from jobs.<name>.permissions (the top-level permissions: {} carries no signal).

Agent job (matches workflow frontmatter) — overwhelmingly read/none, confirming the agent itself runs least-privilege:

Scope	read	write	none
contents	298	0	0
issues	259	0	39
pull-requests	254	0	44
actions	113	0	185
discussions	52	0	246
id-token	0	2	296
all others (checks, pages, statuses, attestations, repository-projects)	0	0	298

Union across all jobs in a workflow (includes the safe-outputs apply job) — 298/298 (100%) grant some write scope:

Scope	write	read	none
issues	298 (100%)	0	0
contents	205	93	0
pull-requests	145	116	37
actions	107	191	0
discussions	96	10	192

Engine distribution

From gh-aw-metadata agent_id (0 unknown across 298 lockfiles):

Engine	Count	%
copilot	124	41.6%
codex	74	24.8%
claude	55	18.5%
pi	31	10.4%
aider / goose	3 each	1.0%
opencode	2	0.7%
crush, cursor, deepseek-harness, gemini, kiro, pydantic-ai	1 each	0.3%

Top resolved models: openai/gpt-5.3-codex (37), copilot/gpt-5.3-codex (33), copilot/auto (30), openai/gpt-5.4 (11), claude-sonnet-5 (6). One workflow resolves its model dynamically at runtime (${{ needs.activation.outputs.model_size }}), invisible to static analysis.

Tool & MCP patterns

MCP server	Workflows using it
safeoutputs	298 (100%)
github	174 (58.4%)
agenticworkflows	44
serena	25
mcpscripts	12
tavily	5
sentry	4

Long tail (1-2 workflows each): ast-grep, datadog, deepwiki, microsoftdocs, grafana, kreuzberg, mempalace, graft, agentdb, ruflo. All 298 lockfiles resolved via manifest parsing — 0 required the legacy comment-scraping fallback.

Interesting findings

1. Universal write escalation via the apply job: every workflow's agent job stays read/none on issues (39 even have none), yet the union across all jobs grants issues: write in 100% of workflows — even though only 48.7% configure create_issue and 25.5% configure add_comment. The safe-outputs apply job appears to request a fixed permission set regardless of which output types are actually enabled.
2. Cron stampede risk: 42 workflows (14% of all lockfiles) fire at the identical 0 0 */2 * * slot, dwarfing every other cron cluster (next-largest is 3).
3. Discussion output is one category short of monoculture: 86% of create_discussion workflows target audits (like this report); the other 6 categories split the remaining 13 workflows thinly.
4. Copilot leads engine share (41.6%) ahead of Codex (24.8%) and Claude (18.5%), with 13 distinct engines represented and zero unresolved.
5. Day-over-day stability: vs. 2026-09-24, lockfile count, trigger counts, create_discussion_workflows, and the full engine distribution are all unchanged; total bytes drifted by only +3,241 (+0.007%) — a quiet 24 hours for workflow authoring.

Historical trends

Compared against prior snapshot 2026-09-24.json (20 days of history available, 2026-08-30 → 2026-09-25):

Metric	2026-09-24	2026-09-25	Δ
Lockfile count	298	298	0
Total bytes	46,797,279	46,800,520	+3,241 (+0.007%)
Avg size	157,037.8	157,048.7	+10.9
workflow_dispatch count	290	290	0
create_discussion workflows	92	92	0
Engine distribution	identical	identical	—

Recommendations

• Audit whether the safe-outputs apply job truly needs issues: write unconditionally, or could scope permissions to only the output types a given workflow configures (least privilege).
• Stagger the 42 workflows sharing the 0 0 */2 * * cron to reduce simultaneous-run contention.
• Reassess discussion-category taxonomy given audits now accounts for 86% of discussion output — consider whether report subtypes warrant their own categories as volume grows.

---

Methodology: single-script compact JSON analysis.

Generated by 📊 Lockfile Statistics Analysis Agent · claude · agent · 71 AIC · ⌖ 7.6 AIC · ⊞ 8.7K · ◷

• expires on Sep 26, 2026, 12:26 PM UTC-08:00

[github-actions[bot]]

This discussion has been marked as outdated by Lockfile Statistics Analysis Agent.

A newer discussion is available at Discussion #63672.